Setting Limit Ranges

Overview

A limit range, defined by a LimitRange object, enumerates
compute resource
constraints in a project at the pod,
container, image, image stream, and persistent volume claim level, and specifies the amount of resources
that a pod, container, image, image stream, or persistent volume claim can consume.

All resource create and modification requests are evaluated against each
LimitRange object in the project. If the resource violates any of the
enumerated constraints, then the resource is rejected. If the resource does not
set an explicit value, and if the constraint supports a default value, then the
default value is applied to the resource.

The maximum size of an image that can be pushed to an internal registry.

2

The maximum number of unique image tags per image stream’s spec.

3

The maximum number of unique image references per image stream’s status.

Both core and OpenShift Container Platform resources can be specified in just one limit range
object. They are separated here into two examples for clarity.

Container Limits

Supported Resources:

CPU

Memory

Supported Constraints:

Per container, the following must hold true if specified:

Table 1. Container

Constraint

Behavior

Min

Min[resource] less than or equal to container.resources.requests[resource]
(required) less than or equal to container/resources.limits[resource]
(optional)

If the configuration defines a min CPU, then the request value must be greater
than the CPU value. A limit value does not need to be specified.

Max

container.resources.limits[resource] (required) less than or equal to
Max[resource]

If the configuration defines a max CPU, then you do not need to define a
request value, but a limit value does need to be set that satisfies the maximum
CPU constraint.

MaxLimitRequestRatio

MaxLimitRequestRatio[resource] less than or equal to (
container.resources.limits[resource] /
container.resources.requests[resource])

If a configuration defines a maxLimitRequestRatio value, then any new
containers must have both a request and limit value. Additionally,
OpenShift Container Platform calculates a limit to request ratio by dividing the limit by the
request. This value should be a non-negative integer greater than 1.

For example, if a container has cpu: 500 in the limit value, and
cpu: 100 in the request value, then its limit to request ratio for cpu is
5. This ratio must be less than or equal to the maxLimitRequestRatio.

Pod Limits

Min[resource] less than or equal to container.resources.requests[resource]
(required) less than or equal to container.resources.limits[resource]
(optional)

Max

container.resources.limits[resource] (required) less than or equal to
Max[resource]

MaxLimitRequestRatio

MaxLimitRequestRatio[resource] less than or equal to (
container.resources.limits[resource] /
container.resources.requests[resource])

Image Limits

Supported Resources:

Storage

Resource type name:

openshift.io/Image

Per image, the following must hold true if specified:

Table 3. Image

Constraint

Behavior

Max

image.dockerimagemetadata.size less than or equal to Max[resource]

To prevent blobs exceeding the limit from being uploaded to the registry, the
registry must be configured to enforce quota. An environment variable
REGISTRY_MIDDLEWARE_REPOSITORY_OPENSHIFT_ENFORCEQUOTA must be set to
true which is done by default for new deployments. To update older
deployment configuration, refer to
Enforcing
quota in the Registry.

The image size is not always available in the manifest of an uploaded image.
This is especially the case for images built with Docker 1.10 or higher and
pushed to a v2 registry. If such an image is pulled with an older Docker daemon,
the image manifest will be converted by the registry to schema v1 lacking all
the size information. No storage limit set on images will prevent it from being
uploaded.

Counting of Image References

Resource openshift.io/image-tags represents unique
image
references. Possible references are an ImageStreamTag, an
ImageStreamImage and a DockerImage. They may be created using commands
oc tag and oc import-image or by using
tag tracking. No distinction
is made between internal and external references. However, each unique reference
tagged in the image stream’s specification is counted just once. It does not
restrict pushes to an internal container registry in any way, but is useful for tag
restriction.

Resource openshift.io/images represents unique image names recorded in image
stream status. It allows for restriction of a number of images that can be
pushed to the internal registry. Internal and external references are not
distinguished.

PersistentVolumeClaim Limits

Supported Resources:

Storage

Supported Constraints:

Across all persistent volume claims in a project, the following must hold true: